# Setting up media bypass and local media optimization for Teams Direct Routing Systems: Microsoft Teams Phone For Teams voice administrators and SBC engineers configuring media bypass and Local Media Optimization. Canonical: https://warmtransfer.net/guides/teams-media-bypass-setup Last verified: 2026-09-30 Media bypass keeps Direct Routing call media between the Session Border Controller (SBC) and the Teams client rather than routing through Microsoft Teams Phone Media Processors[^42]. Local Media Optimization (LMO) builds on media bypass to keep media inside corporate subnets and reach SBCs that sit behind firewalls on private addresses[^27][^24]. ## Before you start Direct Routing requires a Microsoft-certified SBC, PSTN trunks connected to it, users homed online in Microsoft 365, a public IP, an SBC FQDN in a verified tenant domain (excluding `*.onmicrosoft.com`) with public DNS, and a publicly trusted TLS certificate[^68][^69]. Microsoft supports Direct Routing only with certified SBCs, expects the SBC vendor to investigate issues first, and may decline support requests involving non-certified hardware[^70]. Turning on media bypass requires meeting three conditions: the SBC vendor supports it and documents SBC-side configuration, the trunk is switched with `Set-CsOnlinePSTNGateway -Identity -MediaBypass $true`, and all required firewall ports are open[^1]. Microsoft notes that a tenant already using media bypass with SBC public IPs does not need to move to Local Media Optimization[^12]. ## What changes by situation - How should media reach the SBC? Media bypass only (clients reach the SBC's public IP); Local Media Optimization (internal and external SBC addresses, network sites). - What does your SBC estate look like? One central SBC with centralized trunks serving all sites; A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP. - How will you move users onto the bypass trunk? Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy; All at once: Turn on bypass on the existing trunk. ## Step 1: Confirm the SBC is certified for what you chose **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Find your SBC model and firmware in Microsoft's certified SBC list and check the Media bypass column[^60]. Certification for non-media-bypass and media bypass is listed separately, and some certified products are certified for non-media bypass only[^60]. Obtain the vendor's SBC-side media bypass instructions, as vendor support and documentation are required prerequisites[^1]. ### Verify Confirm that your SBC model displays a check mark under Media bypass and that the running firmware meets or exceeds the listed version[^60]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Find your SBC model and firmware in Microsoft's certified SBC list and check the Media bypass column[^60]. Certification for non-media-bypass and media bypass is listed separately, and some certified products are certified for non-media bypass only[^60]. Obtain the vendor's SBC-side media bypass instructions, as vendor support and documentation are required prerequisites[^1]. ### Verify Confirm that your SBC model displays a check mark under Media bypass and that the running firmware meets or exceeds the listed version[^60]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Review the selected options: media bypass alone requires the Teams client to reach the SBC's public IP address[^40]. Downstream SBCs have no public IP addresses and communicate only over internal IPs behind a proxy SBC[^17][^29]. Change the `optimization` selection to `lmo` to support downstream SBC topology[^17][^29]. ### Verify Suggested check: Confirm that your deployment plan uses Local Media Optimization for proxy and downstream SBC topologies. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Review the selected options: media bypass alone requires the Teams client to reach the SBC's public IP address[^40]. Downstream SBCs have no public IP addresses and communicate only over internal IPs behind a proxy SBC[^17][^29]. Change the `optimization` selection to `lmo` to support downstream SBC topology[^17][^29]. ### Verify Suggested check: Confirm that your deployment plan uses Local Media Optimization for proxy and downstream SBC topologies. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Check the certified SBC list for your model in both the Media bypass column and the separate Support for Local Media Optimization table[^60][^61]. Note that Local Media Optimization support has its own minimum software versions distinct from standard media bypass[^61]. Obtain the SBC vendor's LMO configuration guide, as Microsoft requires SBCs to be configured according to vendor specifications[^16]. ### Verify Confirm that your central SBC model is listed in the Local Media Optimization table at or above the required firmware version[^61]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Check the certified SBC list for your model in both the Media bypass column and the separate Support for Local Media Optimization table[^60][^61]. Note that Local Media Optimization support has its own minimum software versions distinct from standard media bypass[^61]. Obtain the SBC vendor's LMO configuration guide, as Microsoft requires SBCs to be configured according to vendor specifications[^16]. ### Verify Confirm that your central SBC model is listed in the Local Media Optimization table at or above the required firmware version[^61]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Check both the proxy SBC and all downstream SBCs against Microsoft's certified SBC list for the Media bypass column and the separate Support for Local Media Optimization table[^60][^61]. Note that Local Media Optimization support has distinct minimum software versions from standard media bypass[^61]. Obtain the SBC vendor's LMO configuration documentation for both the proxy and downstream devices[^16]. ### Verify Confirm that the proxy SBC and all downstream SBCs appear in the Support for Local Media Optimization table at or above the listed minimum software versions[^61]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Check both the proxy SBC and all downstream SBCs against Microsoft's certified SBC list for the Media bypass column and the separate Support for Local Media Optimization table[^60][^61]. Note that Local Media Optimization support has distinct minimum software versions from standard media bypass[^61]. Obtain the SBC vendor's LMO configuration documentation for both the proxy and downstream devices[^16]. ### Verify Confirm that the proxy SBC and all downstream SBCs appear in the Support for Local Media Optimization table at or above the listed minimum software versions[^61]. ### Rollback Suggested rollback: No configuration changes were made in this step. ## Step 2: Check the prerequisites that rule bypass out **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Confirm that the trunk operates over IPv4, because IPv6 is supported on Direct Routing only for non-media-bypass scenarios, and media bypass is not supported with IPv6 SIP, IPv6 media, or the IPv6 Teams client[^10][^6]. Confirm the trunk does not rely on AMR-WB, which Direct Routing supports only without media bypass[^71]. Note that media bypass is supported on standalone Teams desktop clients, Android and iOS clients, and Teams Phone devices, whereas Teams web clients and Skype for Business 3PIP phones are automatically converted to non-bypass[^41]. ### Verify Run `Get-CsOnlinePSTNGateway` and verify that the trunk is not configured with IPv6[^10]. Verify on the SBC that the media profile does not require AMR-WB[^71]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Confirm that the trunk operates over IPv4, because IPv6 is supported on Direct Routing only for non-media-bypass scenarios, and media bypass is not supported with IPv6 SIP, IPv6 media, or the IPv6 Teams client[^10][^6]. Confirm the trunk does not rely on AMR-WB, which Direct Routing supports only without media bypass[^71]. Note that media bypass is supported on standalone Teams desktop clients, Android and iOS clients, and Teams Phone devices, whereas Teams web clients and Skype for Business 3PIP phones are automatically converted to non-bypass[^41]. ### Verify Run `Get-CsOnlinePSTNGateway` and verify that the trunk is not configured with IPv6[^10]. Verify on the SBC that the media profile does not require AMR-WB[^71]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Confirm that media bypass is not deployed over IPv6 SIP, media, or Teams clients, verifying IPv4 candidates[^10][^6]. Verify that AMR-WB is not required[^71]. Note client compatibility rules[^41]. ### Verify Suggested check: Verify IP and codec prerequisites. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Confirm that media bypass is not deployed over IPv6 SIP, media, or Teams clients, verifying IPv4 candidates[^10][^6]. Verify that AMR-WB is not required[^71]. Note client compatibility rules[^41]. ### Verify Suggested check: Verify IP and codec prerequisites. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Confirm the trunk avoids IPv6 SIP or media, confirm IPv4 candidates, verify no dependence on AMR-WB, and confirm client support[^10][^6][^71][^41]. Confirm that remote split-tunnel VPN users are blocked from reaching the SBC internal interface, because a client detected as external is signalled to the SBC as external even if it can reach the internal interface, which can cause prolonged call setup or no audio[^36]. Confirm that no cloud proxy services modify Teams clients' source IP addresses, as network configuration lookups are not supported with IP-modifying cloud proxies[^55]. ### Verify Verify that the trunk has no IPv6 and does not offer AMR-WB[^10][^71]. Confirm that network firewall or VPN access policies block split-tunnel VPN clients from reaching the SBC internal IP[^36]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Confirm the trunk avoids IPv6 SIP or media, confirm IPv4 candidates, verify no dependence on AMR-WB, and confirm client support[^10][^6][^71][^41]. Confirm that remote split-tunnel VPN users are blocked from reaching the SBC internal interface, because a client detected as external is signalled to the SBC as external even if it can reach the internal interface, which can cause prolonged call setup or no audio[^36]. Confirm that no cloud proxy services modify Teams clients' source IP addresses, as network configuration lookups are not supported with IP-modifying cloud proxies[^55]. ### Verify Verify that the trunk has no IPv6 and does not offer AMR-WB[^10][^71]. Confirm that network firewall or VPN access policies block split-tunnel VPN clients from reaching the SBC internal IP[^36]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Confirm the trunk avoids IPv6 SIP or media, confirm IPv4 candidates, verify no dependence on AMR-WB, and confirm client support[^10][^6][^71][^41]. Coordinate with network and VPN administrators to ensure remote split-tunnel VPN users cannot access internal SBC interfaces, preventing prolonged call setup or one-way audio failures[^36]. Verify that enterprise egress paths do not run through cloud proxy services that rewrite client source IP addresses[^55]. ### Verify Verify that the trunk has no IPv6 and does not offer AMR-WB[^10][^71]. Confirm that network routing blocks VPN clients from internal downstream and proxy SBC media addresses[^36]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Confirm the trunk avoids IPv6 SIP or media, confirm IPv4 candidates, verify no dependence on AMR-WB, and confirm client support[^10][^6][^71][^41]. Coordinate with network and VPN administrators to ensure remote split-tunnel VPN users cannot access internal SBC interfaces, preventing prolonged call setup or one-way audio failures[^36]. Verify that enterprise egress paths do not run through cloud proxy services that rewrite client source IP addresses[^55]. ### Verify Verify that the trunk has no IPv6 and does not offer AMR-WB[^10][^71]. Confirm that network routing blocks VPN clients from internal downstream and proxy SBC media addresses[^36]. ### Rollback Suggested rollback: No configuration changes were made in this step. ## Step 3: Configure ICE Lite and SRTP on the SBC **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Configure ICE Lite and SRTP on the SBC Teams-facing interface per vendor instructions[^44][^1]. Ensure the SBC configuration meets Microsoft's ICE Lite and media specifications: - The SBC must offer only one ICE candidate, and only an IPv4 candidate is supported[^6]. - The SBC's ICE Lite implementation must respond to every connectivity check received and must not send connectivity check requests[^4]. RFC 8445 defines lite ICE agents as using only host candidates and not generating connectivity checks or running state machines, while still responding to connectivity checks[^59]. - The SBC must answer connectivity checks and accept nominations from multiple forked Teams endpoints, before or after 200 OK, and must not change ICE candidates, password, or ufrag between a 183 Session Progress and 200 OK[^5]. - In bypass mode the SBC must support SRTP cipher `AES_CM_128_HMAC_SHA1_80`, and its SDP offer must contain SDES (DTLS is optional)[^64]. - The SBC must answer non-audio m-lines with port 0 per RFC 3264 to reject them, because Direct Routing does not strip non-audio m-lines in bypass mode[^63]. - Ensure media re-targeting is disabled, because Teams Direct Routing never sends media to a new address signalled mid-call even if negotiated in SIP[^62]. ### Verify In an SBC SIP and media trace of a test call, verify that the SDP contains a single IPv4 candidate, contains an `a=crypto` line with `AES_CM_128_HMAC_SHA1_80`, and shows that the SBC sends no outbound STUN connectivity checks[^6][^64][^4]. ### Rollback Revert the ICE Lite settings on the SBC according to vendor procedures[^1]. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Configure ICE Lite and SRTP on the SBC Teams-facing interface per vendor instructions[^44][^1]. Ensure the SBC configuration meets Microsoft's ICE Lite and media specifications: - The SBC must offer only one ICE candidate, and only an IPv4 candidate is supported[^6]. - The SBC's ICE Lite implementation must respond to every connectivity check received and must not send connectivity check requests[^4]. RFC 8445 defines lite ICE agents as using only host candidates and not generating connectivity checks or running state machines, while still responding to connectivity checks[^59]. - The SBC must answer connectivity checks and accept nominations from multiple forked Teams endpoints, before or after 200 OK, and must not change ICE candidates, password, or ufrag between a 183 Session Progress and 200 OK[^5]. - In bypass mode the SBC must support SRTP cipher `AES_CM_128_HMAC_SHA1_80`, and its SDP offer must contain SDES (DTLS is optional)[^64]. - The SBC must answer non-audio m-lines with port 0 per RFC 3264 to reject them, because Direct Routing does not strip non-audio m-lines in bypass mode[^63]. - Ensure media re-targeting is disabled, because Teams Direct Routing never sends media to a new address signalled mid-call even if negotiated in SIP[^62]. ### Verify In an SBC SIP and media trace of a test call, verify that the SDP contains a single IPv4 candidate, contains an `a=crypto` line with `AES_CM_128_HMAC_SHA1_80`, and shows that the SBC sends no outbound STUN connectivity checks[^6][^64][^4]. ### Rollback Revert the ICE Lite settings on the SBC according to vendor procedures[^1]. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Configure ICE Lite and SRTP on the SBC interfaces per vendor instructions[^44][^1][^64]. ### Verify Suggested check: Verify ICE Lite and SRTP parameters in SBC logging. ### Rollback Revert the ICE Lite configuration on the SBC[^1]. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Configure ICE Lite and SRTP on the SBC interfaces per vendor instructions[^44][^1][^64]. ### Verify Suggested check: Verify ICE Lite and SRTP parameters in SBC logging. ### Rollback Revert the ICE Lite configuration on the SBC[^1]. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Configure ICE Lite, single IPv4 candidate gathering, connectivity checks response, non-audio m-line port 0 handling, and SRTP SDES `AES_CM_128_HMAC_SHA1_80` on the SBC[^44][^6][^4][^63][^64]. Configure the SBC per vendor specifications to support Local Media Optimization: - Configure the central SBC to parse incoming `X-MS-UserLocation` and `X-MS-MediaPath` headers[^37]. - Configure the SBC to offer its internal IP for media when the user is internal and its external (public) IP when the user is external, while keeping its signaling presence visible to Teams Phone via its external IP only[^15]. - Ensure the SBC offers local media candidates by default on inbound calls and sends a re-INVITE if the user turns out to be external[^20]. ### Verify Review the SBC running configuration to verify that ICE Lite is active, internal and external media interfaces are defined, and LMO SIP header handling is enabled[^16][^15]. ### Rollback Revert the LMO and ICE Lite settings on the SBC according to the vendor's procedure[^16]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Configure ICE Lite, single IPv4 candidate gathering, connectivity checks response, non-audio m-line port 0 handling, and SRTP SDES `AES_CM_128_HMAC_SHA1_80` on the SBC[^44][^6][^4][^63][^64]. Configure the SBC per vendor specifications to support Local Media Optimization: - Configure the central SBC to parse incoming `X-MS-UserLocation` and `X-MS-MediaPath` headers[^37]. - Configure the SBC to offer its internal IP for media when the user is internal and its external (public) IP when the user is external, while keeping its signaling presence visible to Teams Phone via its external IP only[^15]. - Ensure the SBC offers local media candidates by default on inbound calls and sends a re-INVITE if the user turns out to be external[^20]. ### Verify Review the SBC running configuration to verify that ICE Lite is active, internal and external media interfaces are defined, and LMO SIP header handling is enabled[^16][^15]. ### Rollback Revert the LMO and ICE Lite settings on the SBC according to the vendor's procedure[^16]. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Configure ICE Lite, candidate handling, and SRTP SDES on the proxy and downstream SBCs[^44][^6][^4][^63][^64]. Configure the proxy and downstream SBCs per vendor specifications: - Enable the proxy SBC to process `X-MS-UserLocation`, `X-MS-MediaPath`, and `X-MS-UserSite` headers and forward traffic across internal IPs to downstream SBCs[^37][^29]. - Configure downstream SBCs to listen on internal interfaces and process direct media from branch users[^17]. - Ensure inbound calls default to local media candidates and trigger re-INVITE handling when users are external[^20]. ### Verify Confirm in SBC management interfaces that ICE Lite and LMO header processing are enabled on both the proxy SBC and downstream SBCs[^16]. ### Rollback Revert LMO and ICE Lite configurations on the downstream SBCs and proxy SBC according to vendor procedures[^16]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Configure ICE Lite, candidate handling, and SRTP SDES on the proxy and downstream SBCs[^44][^6][^4][^63][^64]. Configure the proxy and downstream SBCs per vendor specifications: - Enable the proxy SBC to process `X-MS-UserLocation`, `X-MS-MediaPath`, and `X-MS-UserSite` headers and forward traffic across internal IPs to downstream SBCs[^37][^29]. - Configure downstream SBCs to listen on internal interfaces and process direct media from branch users[^17]. - Ensure inbound calls default to local media candidates and trigger re-INVITE handling when users are external[^20]. ### Verify Confirm in SBC management interfaces that ICE Lite and LMO header processing are enabled on both the proxy SBC and downstream SBCs[^16]. ### Rollback Revert LMO and ICE Lite configurations on the downstream SBCs and proxy SBC according to vendor procedures[^16]. ## Step 4: Open the media firewall paths **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Open the required network firewall paths for media bypass: - Client to SBC public IP: Allow UDP/SRTP from client ports 50000-50019 to the SBC's media ports in both directions[^39]. If any network device translates client source ports, open the translated ports towards the SBC[^39]. For internal clients reaching the SBC public IP, hair-pinning can be configured on the NAT device so traffic never leaves enterprise equipment[^40]. - Transport Relays to SBC: Microsoft recommends opening the SBC public IP only to the Microsoft cloud so external users are relayed[^43]. Open Transport Relay IP ranges: `52.112.0.0/14` for Microsoft 365, Office 365, and GCC; `52.127.88.0/21` for GCC High; `52.127.64.0/21` for DoD[^50]. Note that Microsoft lists both `52.112.0.0/14` and `52.120.0.0/14` in its relay summary and signaling sections, but lists `52.112.0.0/14` only in its relay port requirement section[^48]. - Relay ports: The SBC must allow UDP/SRTP from relays on source ports 50000-59999 and send to relays on ports 50000-59999 and 3478-3481 (relay version v4 uses 50000-59999 and v6 uses 3478-3481)[^49]. - Non-bypass ports: Keep Direct Routing Media Processor ports open (UDP/SRTP ports 3478-3481 and 49152-53247 in both directions) because Media Processors remain in the path for voice applications and web clients[^72][^46]. ### Verify Verify from an internal client subnet that UDP traffic to the SBC public media ports is permitted[^39]. Inspect firewall logs to verify that UDP/SRTP traffic from `52.112.0.0/14` on ports 50000-59999 reaches the SBC[^49][^50]. ### Rollback Suggested rollback: Remove the client-to-SBC and Transport Relay firewall rules while retaining standard Media Processor firewall access. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Open the required network firewall paths for media bypass: - Client to SBC public IP: Allow UDP/SRTP from client ports 50000-50019 to the SBC's media ports in both directions[^39]. If any network device translates client source ports, open the translated ports towards the SBC[^39]. For internal clients reaching the SBC public IP, hair-pinning can be configured on the NAT device so traffic never leaves enterprise equipment[^40]. - Transport Relays to SBC: Microsoft recommends opening the SBC public IP only to the Microsoft cloud so external users are relayed[^43]. Open Transport Relay IP ranges: `52.112.0.0/14` for Microsoft 365, Office 365, and GCC; `52.127.88.0/21` for GCC High; `52.127.64.0/21` for DoD[^50]. Note that Microsoft lists both `52.112.0.0/14` and `52.120.0.0/14` in its relay summary and signaling sections, but lists `52.112.0.0/14` only in its relay port requirement section[^48]. - Relay ports: The SBC must allow UDP/SRTP from relays on source ports 50000-59999 and send to relays on ports 50000-59999 and 3478-3481 (relay version v4 uses 50000-59999 and v6 uses 3478-3481)[^49]. - Non-bypass ports: Keep Direct Routing Media Processor ports open (UDP/SRTP ports 3478-3481 and 49152-53247 in both directions) because Media Processors remain in the path for voice applications and web clients[^72][^46]. ### Verify Verify from an internal client subnet that UDP traffic to the SBC public media ports is permitted[^39]. Inspect firewall logs to verify that UDP/SRTP traffic from `52.112.0.0/14` on ports 50000-59999 reaches the SBC[^49][^50]. ### Rollback Suggested rollback: Remove the client-to-SBC and Transport Relay firewall rules while retaining standard Media Processor firewall access. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Open UDP/SRTP client ports 50000-50019 to the SBC media ports, and open Transport Relay IP ranges and ports[^39][^50][^49]. Retain Media Processor port rules[^72][^46]. ### Verify Suggested check: Verify firewall rules permitting client and relay traffic to the SBC. ### Rollback Suggested rollback: Remove media bypass firewall allowances. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Open UDP/SRTP client ports 50000-50019 to the SBC media ports, and open Transport Relay IP ranges and ports[^39][^50][^49]. Retain Media Processor port rules[^72][^46]. ### Verify Suggested check: Verify firewall rules permitting client and relay traffic to the SBC. ### Rollback Suggested rollback: Remove media bypass firewall allowances. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Open external paths to the central SBC's public interface for external users: client UDP/SRTP ports 50000-50019, Transport Relay ranges (`52.112.0.0/14`, `52.127.88.0/21`, or `52.127.64.0/21`), and relay ports 50000-59999 and 3478-3481[^39][^50][^49]. Open internal firewall paths between all internal client subnets and the central SBC's internal media IP, because internal LMO users have no fallback to public Transport Relays[^25]. Maintain Media Processor ports 3478-3481 and 49152-53247[^72][^46]. ### Verify Verify that UDP packets from each internal site subnet reach the central SBC's internal media IP and ports without dropping[^25]. ### Rollback Suggested rollback: Remove internal firewall allowances directing client subnets to the central SBC internal IP. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Open external paths to the central SBC's public interface for external users: client UDP/SRTP ports 50000-50019, Transport Relay ranges (`52.112.0.0/14`, `52.127.88.0/21`, or `52.127.64.0/21`), and relay ports 50000-59999 and 3478-3481[^39][^50][^49]. Open internal firewall paths between all internal client subnets and the central SBC's internal media IP, because internal LMO users have no fallback to public Transport Relays[^25]. Maintain Media Processor ports 3478-3481 and 49152-53247[^72][^46]. ### Verify Verify that UDP packets from each internal site subnet reach the central SBC's internal media IP and ports without dropping[^25]. ### Rollback Suggested rollback: Remove internal firewall allowances directing client subnets to the central SBC internal IP. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do On the proxy SBC, open external client paths and Transport Relay ranges (`52.112.0.0/14`, `52.127.88.0/21`, `52.127.64.0/21`) and ports[^39][^50][^49]. Open internal paths allowing each branch subnet to reach its downstream SBC's internal media address, and across all internal subnets if using Always bypass mode[^25][^22]. Allow internal media routing between the proxy SBC and each downstream SBC[^17]. ### Verify Verify that each downstream SBC internal media IP is reachable via UDP from its local branch subnets and from the proxy SBC[^17][^25]. ### Rollback Suggested rollback: Remove internal network routing and firewall rules connecting downstream SBCs to local subnets and proxy SBCs. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do On the proxy SBC, open external client paths and Transport Relay ranges (`52.112.0.0/14`, `52.127.88.0/21`, `52.127.64.0/21`) and ports[^39][^50][^49]. Open internal paths allowing each branch subnet to reach its downstream SBC's internal media address, and across all internal subnets if using Always bypass mode[^25][^22]. Allow internal media routing between the proxy SBC and each downstream SBC[^17]. ### Verify Verify that each downstream SBC internal media IP is reachable via UDP from its local branch subnets and from the proxy SBC[^17][^25]. ### Rollback Suggested rollback: Remove internal network routing and firewall rules connecting downstream SBCs to local subnets and proxy SBCs. ## Step 5: Add external trusted IPs **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Skip this step, as trusted IP addresses are required for Local Media Optimization site identification rather than standard media bypass[^16]. ### Verify Suggested check: Confirm that no trusted IP configuration is required for plain media bypass. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Skip this step, as trusted IP addresses are required for Local Media Optimization site identification rather than standard media bypass[^16]. ### Verify Suggested check: Confirm that no trusted IP configuration is required for plain media bypass. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Skip this step[^16]. ### Verify Suggested check: No verification required. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Skip this step[^16]. ### Verify Suggested check: No verification required. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Add the external internet egress IP addresses that Teams clients present to Microsoft 365 for every site hosting LMO users[^34]. Configure these using `New-CsTenantTrustedIPAddress` in PowerShell or navigate to **Locations > Network topology > Trusted IPs** in the Teams admin center[^34][^65]. Use mask 32 for single IPv4 addresses, 128 for IPv6, and add both families if Microsoft 365 sees both[^34]. ### Verify Verify under **Locations > Network topology > Trusted IPs** that all egress IP addresses are listed[^65]. Note that changes to network settings can take up to 4 hours to propagate to Teams clients[^56]. ### Rollback In the Teams admin center under **Locations > Network topology > Trusted IPs**, select and delete or edit the entries added for this configuration[^65]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Add the external internet egress IP addresses that Teams clients present to Microsoft 365 for every site hosting LMO users[^34]. Configure these using `New-CsTenantTrustedIPAddress` in PowerShell or navigate to **Locations > Network topology > Trusted IPs** in the Teams admin center[^34][^65]. Use mask 32 for single IPv4 addresses, 128 for IPv6, and add both families if Microsoft 365 sees both[^34]. ### Verify Verify under **Locations > Network topology > Trusted IPs** that all egress IP addresses are listed[^65]. Note that changes to network settings can take up to 4 hours to propagate to Teams clients[^56]. ### Rollback In the Teams admin center under **Locations > Network topology > Trusted IPs**, select and delete or edit the entries added for this configuration[^65]. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do For each branch office and proxy site with LMO users, configure the public egress IP addresses using `New-CsTenantTrustedIPAddress` or under **Locations > Network topology > Trusted IPs**[^34][^65]. Use mask 32 for individual IPv4 addresses and 128 for IPv6, adding both address families if seen by Microsoft 365[^34]. ### Verify Confirm all branch egress IP entries appear in **Locations > Network topology > Trusted IPs**[^65]. Allow up to 4 hours for propagation before testing[^56]. ### Rollback Remove the configured branch trusted IPs in the Teams admin center under **Locations > Network topology > Trusted IPs**[^65]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do For each branch office and proxy site with LMO users, configure the public egress IP addresses using `New-CsTenantTrustedIPAddress` or under **Locations > Network topology > Trusted IPs**[^34][^65]. Use mask 32 for individual IPv4 addresses and 128 for IPv6, adding both address families if seen by Microsoft 365[^34]. ### Verify Confirm all branch egress IP entries appear in **Locations > Network topology > Trusted IPs**[^65]. Allow up to 4 hours for propagation before testing[^56]. ### Rollback Remove the configured branch trusted IPs in the Teams admin center under **Locations > Network topology > Trusted IPs**[^65]. ## Step 6: Define network regions, sites and subnets **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Skip this step, as network sites and subnets are not used for plain media bypass[^16]. ### Verify Suggested check: Confirm no network topology definitions are needed. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Skip this step, as network sites and subnets are not used for plain media bypass[^16]. ### Verify Suggested check: Confirm no network topology definitions are needed. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Skip this step[^16]. ### Verify Suggested check: No verification required. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Skip this step[^16]. ### Verify Suggested check: No verification required. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Define the LMO network topology in PowerShell or in the Teams admin center under **Locations > Network topology > Network sites**[^65][^16]: - Create network regions using `New-CsTenantNetworkRegion`[^33]. - Create network sites using `New-CsTenantNetworkSite`, tying each site to a region[^33]. If all SBCs are reachable from any site, a single site can be configured for all users and SBCs[^11]. Note that site ID values are case sensitive (for example, "Vietnam" and "vietnam" are treated as different sites)[^14]. - Create subnets with `New-CsTenantNetworkSubnet`, tying each subnet to exactly one site[^33]. Cover all internal subnets, because a client whose public IP matches trusted IPs but whose subnet matches no site is treated as external[^32]. ### Verify Confirm that all subnets appear assigned to their intended network sites under **Locations > Network topology > Network sites**[^65]. Note that propagation to clients may take up to 4 hours[^56]. ### Rollback In the Teams admin center, remove the subnets and network sites created for LMO under **Locations > Network topology > Network sites**[^65]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Define the LMO network topology in PowerShell or in the Teams admin center under **Locations > Network topology > Network sites**[^65][^16]: - Create network regions using `New-CsTenantNetworkRegion`[^33]. - Create network sites using `New-CsTenantNetworkSite`, tying each site to a region[^33]. If all SBCs are reachable from any site, a single site can be configured for all users and SBCs[^11]. Note that site ID values are case sensitive (for example, "Vietnam" and "vietnam" are treated as different sites)[^14]. - Create subnets with `New-CsTenantNetworkSubnet`, tying each subnet to exactly one site[^33]. Cover all internal subnets, because a client whose public IP matches trusted IPs but whose subnet matches no site is treated as external[^32]. ### Verify Confirm that all subnets appear assigned to their intended network sites under **Locations > Network topology > Network sites**[^65]. Note that propagation to clients may take up to 4 hours[^56]. ### Rollback In the Teams admin center, remove the subnets and network sites created for LMO under **Locations > Network topology > Network sites**[^65]. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Create network regions with `New-CsTenantNetworkRegion`, network sites with `New-CsTenantNetworkSite`, and subnets with `New-CsTenantNetworkSubnet`[^33]. Ensure that every branch subnet egressing through a trusted IP is associated with its corresponding site, maintaining consistent character casing for site IDs[^14][^32]. ### Verify Check **Locations > Network topology > Network sites** to ensure all branch subnets map to distinct branch sites[^65]. ### Rollback Remove the created subnets and branch sites under **Locations > Network topology > Network sites**[^65]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Create network regions with `New-CsTenantNetworkRegion`, network sites with `New-CsTenantNetworkSite`, and subnets with `New-CsTenantNetworkSubnet`[^33]. Ensure that every branch subnet egressing through a trusted IP is associated with its corresponding site, maintaining consistent character casing for site IDs[^14][^32]. ### Verify Check **Locations > Network topology > Network sites** to ensure all branch subnets map to distinct branch sites[^65]. ### Rollback Remove the created subnets and branch sites under **Locations > Network topology > Network sites**[^65]. ## Step 7: Turn on media bypass for the trunk **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Configure a secondary bypass trunk to execute Microsoft's recommended phased migration[^2]: - On the SBC, create a second trunk pointing to Teams using a new FQDN and a different TLS signaling port, keeping the same media ports[^52]. - Ensure the SBC certificate covers both FQDNs using Subject Alternative Name (SAN) entries or a wildcard certificate[^38]. - Pair the new trunk using `New-CsOnlinePSTNGateway -Identity ` and enable bypass with `Set-CsOnlinePSTNGateway -Identity -MediaBypass $true`[^1][^47]. - Create an Online Voice Routing Policy referencing the new bypass trunk and assign it to pilot test users[^52]. ### Verify Run `Get-CsOnlinePSTNGateway -Identity ` and verify that `Enabled` is True and `MediaBypass` is True[^67][^58]. Confirm on the SBC that SIP OPTIONS in both directions are answered with 200 OK[^67]. ### Rollback Reassign the pilot users' voice routing policy back to the existing non-bypass trunk[^52]. Set `Set-CsOnlinePSTNGateway -Identity -MediaBypass $false`[^47]. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Enable media bypass on the existing trunk by running `Set-CsOnlinePSTNGateway -Identity -MediaBypass $true` during an authorized maintenance window[^1]. Note that switching all users at once immediately exposes all production users to initial trunk and port issues[^2]. ### Verify Run `Get-CsOnlinePSTNGateway -Identity ` and confirm `MediaBypass` is True[^58]. Check **Voice > Direct Routing** in the Teams admin center to verify TLS connectivity and SIP options status remain healthy[^3]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $false`, restoring the parameter to its default setting[^58]. Revert the SBC ICE Lite configuration[^1]. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Configure a second trunk FQDN on a different TLS signaling port, ensure the TLS certificate covers both FQDNs, pair with `New-CsOnlinePSTNGateway`, and run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $true`[^52][^38][^47]. Assign a voice routing policy pointing to this trunk to pilot users[^52]. ### Verify Verify `Get-CsOnlinePSTNGateway` shows `MediaBypass` as True and OPTIONS respond with 200 OK[^67][^58]. ### Rollback Reassign pilot users to the non-bypass voice routing policy and set `-MediaBypass $false`[^52][^58]. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $true` on the existing gateway[^1]. ### Verify Verify `MediaBypass` shows True via `Get-CsOnlinePSTNGateway`[^58]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $false`[^58]. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Create a second trunk on the central SBC using a distinct FQDN and signaling port with shared media ports[^52]. Verify SAN or wildcard certificate coverage[^38]. Pair the gateway and enable media bypass with `Set-CsOnlinePSTNGateway -Identity -MediaBypass $true`, which is required for LMO[^24]. Route pilot users to this gateway using an Online Voice Routing Policy[^52]. ### Verify Verify that `Get-CsOnlinePSTNGateway -Identity ` displays `MediaBypass` as True and OPTIONS are answered with 200 OK[^67][^58]. ### Rollback Reassign pilot users back to their original voice routing policy[^52]. Set `-MediaBypass $false` on the pilot gateway[^58]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $true` on the existing central trunk[^1][^24]. ### Verify Confirm that `Get-CsOnlinePSTNGateway -Identity ` returns `MediaBypass` as True[^58]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $false`[^58]. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do On the proxy SBC, configure a second trunk FQDN with a unique TLS port and matching certificate SAN, then run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $true`[^52][^38][^24]. Create pilot voice routing policies targeting the new proxy gateway[^52]. ### Verify Verify `MediaBypass` is True on `` via `Get-CsOnlinePSTNGateway`[^58]. ### Rollback Reassign users to the non-bypass policy and set `-MediaBypass $false` on the pilot proxy gateway[^52][^58]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $true` on the proxy SBC gateway[^1][^24]. ### Verify Run `Get-CsOnlinePSTNGateway -Identity ` and confirm `MediaBypass` is True[^58]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $false`[^58]. ## Step 8: Place SBCs in the virtual network topology **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Leave `-BypassMode` at its default value of None, and if an SBC does not have `-BypassMode` set, Direct Routing does not send the X-MS headers used by Local Media Optimization[^57][^13]. ### Verify Run `Get-CsOnlinePSTNGateway` and confirm that `BypassMode` is None[^57]. ### Rollback Suggested rollback: No virtual topology parameters were set in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Leave `-BypassMode` at its default value of None, and if an SBC does not have `-BypassMode` set, Direct Routing does not send the X-MS headers used by Local Media Optimization[^57][^13]. ### Verify Run `Get-CsOnlinePSTNGateway` and confirm that `BypassMode` is None[^57]. ### Rollback Suggested rollback: No virtual topology parameters were set in this step. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Leave `-BypassMode` at its default value of None[^57]. ### Verify Suggested check: Verify BypassMode is None via Get-CsOnlinePSTNGateway. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Leave `-BypassMode` at its default value of None[^57]. ### Verify Suggested check: Verify BypassMode is None via Get-CsOnlinePSTNGateway. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Assign the central SBC to the virtual network topology by executing: `Set-CsOnlinePSTNGateway -Identity -GatewaySiteID -MediaBypass $true -BypassMode Always -ProxySBC $null`[^18][^24]. For a single central SBC, `-ProxySBC` must be set either to `$null` or to the SBC's own FQDN[^31]. Always bypass mode indicates a fully routable network between sites and is the simplest mode to configure[^57][^11]. Ensure the casing of `` matches the defined network site exactly[^14]. ### Verify Run `Get-CsOnlinePSTNGateway -Identity ` and confirm `GatewaySiteId` is populated, `MediaBypass` is True, and `BypassMode` is Always[^18]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -BypassMode None -GatewaySiteID $null` to stop Direct Routing from sending X-MS headers[^57][^13]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Assign the central SBC to the virtual network topology by executing: `Set-CsOnlinePSTNGateway -Identity -GatewaySiteID -MediaBypass $true -BypassMode Always -ProxySBC $null`[^18][^24]. For a single central SBC, `-ProxySBC` must be set either to `$null` or to the SBC's own FQDN[^31]. Always bypass mode indicates a fully routable network between sites and is the simplest mode to configure[^57][^11]. Ensure the casing of `` matches the defined network site exactly[^14]. ### Verify Run `Get-CsOnlinePSTNGateway -Identity ` and confirm `GatewaySiteId` is populated, `MediaBypass` is True, and `BypassMode` is Always[^18]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -BypassMode None -GatewaySiteID $null` to stop Direct Routing from sending X-MS headers[^57][^13]. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do - Configure the proxy SBC gateway: `Set-CsOnlinePSTNGateway -Identity -GatewaySiteID -MediaBypass $true -BypassMode Always -ProxySBC $null`[^31][^23]. - Create each downstream SBC with `New-CsOnlinePSTNGateway` and set `-GatewaySiteID`, `-MediaBypass`, `-BypassMode`, and `-ProxySBC`: `Set-CsOnlinePSTNGateway -Identity -GatewaySiteID -MediaBypass $true -BypassMode -ProxySBC `[^18][^31]. - Select `Always` where inter-branch connectivity is good, or `OnlyForLocalUsers` where branch sites connect reliably only to the hub[^22][^23][^57]. - If Location-Based Routing (LBR) is configured with LMO, set `-GatewaySiteLbrEnabled $true` on each downstream SBC (not mandatory for proxy SBCs)[^21]. Match site ID casing exactly[^14]. ### Verify Run `Get-CsOnlinePSTNGateway` for each gateway and verify that `GatewaySiteId`, `BypassMode`, and `ProxySBC` match the planned topology[^18]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -BypassMode None` across proxy and downstream gateways[^57][^13]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do - Configure the proxy SBC gateway: `Set-CsOnlinePSTNGateway -Identity -GatewaySiteID -MediaBypass $true -BypassMode Always -ProxySBC $null`[^31][^23]. - Create each downstream SBC with `New-CsOnlinePSTNGateway` and set `-GatewaySiteID`, `-MediaBypass`, `-BypassMode`, and `-ProxySBC`: `Set-CsOnlinePSTNGateway -Identity -GatewaySiteID -MediaBypass $true -BypassMode -ProxySBC `[^18][^31]. - Select `Always` where inter-branch connectivity is good, or `OnlyForLocalUsers` where branch sites connect reliably only to the hub[^22][^23][^57]. - If Location-Based Routing (LBR) is configured with LMO, set `-GatewaySiteLbrEnabled $true` on each downstream SBC (not mandatory for proxy SBCs)[^21]. Match site ID casing exactly[^14]. ### Verify Run `Get-CsOnlinePSTNGateway` for each gateway and verify that `GatewaySiteId`, `BypassMode`, and `ProxySBC` match the planned topology[^18]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -BypassMode None` across proxy and downstream gateways[^57][^13]. ## Step 9: Route calls to the right SBC **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Maintain the routing policies using separate trunks, routing pilot users to the bypass trunk and remaining users to the existing trunk[^52]. ### Verify Suggested check: Verify that assigned voice routing policies target the appropriate gateway for pilot and standard users. ### Rollback Suggested rollback: Reassign pilot users back to their original voice routing policies. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Retain your existing voice routing policies, as the trunk FQDN remains unchanged[^1]. ### Verify Suggested check: Verify that existing voice routes continue to resolve to the central SBC gateway FQDN. ### Rollback Suggested rollback: No routing changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Maintain voice routing policies pointing pilot users to the test trunk[^52]. ### Verify Suggested check: Verify policy assignments in PowerShell or the Teams admin center. ### Rollback Suggested rollback: Revert pilot user policy assignments. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Retain existing voice routing policies[^1]. ### Verify Suggested check: Verify existing routing policy resolution. ### Rollback Suggested rollback: No routing changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Retain voice routes pointing to the central SBC, which handles PSTN connectivity for all branch locations[^29]. ### Verify Suggested check: Verify that voice routes correctly list the central SBC gateway FQDN. ### Rollback Suggested rollback: No routing changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Retain voice routes pointing to the central SBC, which handles PSTN connectivity for all branch locations[^29]. ### Verify Suggested check: Verify that voice routes correctly list the central SBC gateway FQDN. ### Rollback Suggested rollback: No routing changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do In the relevant Online Voice Routing Policy, configure two voice routes: - A priority-1 route matching the branch local number pattern (for example, `^+84(\d{9})$`), routed to the downstream SBC[^28]. Note that downstream SBCs can be assigned to voice routes even though they have no public IPs[^17]. - A priority-2 route matching `.*`, routed to the proxy SBC, which handles all other calls and catches local calls if the downstream SBC fails[^28]. ### Verify Place a test call to a local number and verify in SBC signaling traces that the downstream SBC's FQDN appears in the Request-URI[^37]. ### Rollback Remove the priority-1 voice route pointing to the downstream SBC so that calls fall back to the proxy SBC route[^28]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do In the relevant Online Voice Routing Policy, configure two voice routes: - A priority-1 route matching the branch local number pattern (for example, `^+84(\d{9})$`), routed to the downstream SBC[^28]. Note that downstream SBCs can be assigned to voice routes even though they have no public IPs[^17]. - A priority-2 route matching `.*`, routed to the proxy SBC, which handles all other calls and catches local calls if the downstream SBC fails[^28]. ### Verify Place a test call to a local number and verify in SBC signaling traces that the downstream SBC's FQDN appears in the Request-URI[^37]. ### Rollback Remove the priority-1 voice route pointing to the downstream SBC so that calls fall back to the proxy SBC route[^28]. ## Step 10: Confirm trunk health ### Do Verify gateway connectivity by running `Get-CsOnlinePSTNGateway -Identity ` in PowerShell and monitoring SIP OPTIONS ping transactions directly on the SBC[^67]. Open **Voice > Direct Routing** in the Teams admin center to review the Direct Routing health dashboard[^3]. ### Verify Confirm that `Get-CsOnlinePSTNGateway` shows `Enabled` as True and that SBC logs show mutual 200 OK responses to OPTIONS pings[^67]. In the Direct Routing health dashboard, verify that TLS connectivity and SIP options status report Active, and that network effectiveness is not degraded[^3]. Note that dashboard jitter, packet loss, and latency metrics are measured between Direct Routing and the SBC, not across the bypassed client media leg[^3]. ## Step 11: Verify the media path with test calls **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Place test calls from a Teams desktop client on the enterprise network, from an external Teams desktop client, and from a Teams web client[^41]. Capture SIP signaling and media packets on the SBC[^39]. ### Verify Inspect the SBC media stream for each test scenario: - Internal desktop client: Media travels directly between the SBC public IP and the client (or NAT) IP on client ports 50000-50019[^39]. SIP signaling always flows via the Microsoft cloud[^53]. - External client: Media arrives from an IP address within the Transport Relay ranges (`52.112.0.0/14`, `52.127.88.0/21`, or `52.127.64.0/21`)[^50][^51]. - Web client: Media connects to Microsoft Media Processors[^46]. If a call fails before reaching Direct Routing internal components, check the SBC logs for detailed error descriptions[^54]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Place test calls from a Teams desktop client on the enterprise network, from an external Teams desktop client, and from a Teams web client[^41]. Capture SIP signaling and media packets on the SBC[^39]. ### Verify Inspect the SBC media stream for each test scenario: - Internal desktop client: Media travels directly between the SBC public IP and the client (or NAT) IP on client ports 50000-50019[^39]. SIP signaling always flows via the Microsoft cloud[^53]. - External client: Media arrives from an IP address within the Transport Relay ranges (`52.112.0.0/14`, `52.127.88.0/21`, or `52.127.64.0/21`)[^50][^51]. - Web client: Media connects to Microsoft Media Processors[^46]. If a call fails before reaching Direct Routing internal components, check the SBC logs for detailed error descriptions[^54]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Place test calls from internal, external, and web clients while capturing media traces on the SBC[^41][^39]. ### Verify Verify direct client IP connection on internal calls, Transport Relay addresses on external calls, and Media Processors on web clients[^39][^51][^46]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Place test calls from internal, external, and web clients while capturing media traces on the SBC[^41][^39]. ### Verify Verify direct client IP connection on internal calls, Transport Relay addresses on external calls, and Media Processors on web clients[^39][^51][^46]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Place inbound and outbound test calls from an internal network subnet and from an external network, capturing SIP signaling and media on the central SBC[^37]. ### Verify Inspect SIP headers and media streams: - Internal user: Outbound and inbound INVITEs contain `X-MS-UserLocation: internal` and `X-MS-UserSite: `, and media flows over the central SBC's internal IP address[^37][^15]. If an internal client shows as external, verify trusted IP and subnet-to-site assignments[^32]. - External user: Signaling contains `X-MS-UserLocation: external`, and media connects to the SBC's external public IP[^37][^15]. - Inbound call to an external user: Confirm the SBC sends a re-INVITE after the initial offer with local candidates[^20]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Place inbound and outbound test calls from an internal network subnet and from an external network, capturing SIP signaling and media on the central SBC[^37]. ### Verify Inspect SIP headers and media streams: - Internal user: Outbound and inbound INVITEs contain `X-MS-UserLocation: internal` and `X-MS-UserSite: `, and media flows over the central SBC's internal IP address[^37][^15]. If an internal client shows as external, verify trusted IP and subnet-to-site assignments[^32]. - External user: Signaling contains `X-MS-UserLocation: external`, and media connects to the SBC's external public IP[^37][^15]. - Inbound call to an external user: Confirm the SBC sends a re-INVITE after the initial offer with local candidates[^20]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Place test calls from a branch user to a local number, from a remote branch user, and from an external user, capturing SIP messages on the proxy SBC and downstream SBCs[^37]. ### Verify Inspect the SIP signaling and media routing: - Local branch user: `X-MS-UserLocation: internal` is present, `X-MS-MediaPath` lists only the downstream SBC, and media connects directly to the downstream SBC internal IP[^26][^17]. - External user: `X-MS-UserLocation: external` is present, `X-MS-MediaPath` lists the proxy SBC and then the downstream SBC, and media flows to the proxy SBC public IP[^26][^17]. - Inter-branch user: If the downstream SBC is in `Always` mode, media goes directly to its internal IP; if in `OnlyForLocalUsers` mode, media routes via the proxy SBC[^22][^23]. - Note that users may experience a few seconds of silence during initial call establishment due to architectural complexity[^30]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Place test calls from a branch user to a local number, from a remote branch user, and from an external user, capturing SIP messages on the proxy SBC and downstream SBCs[^37]. ### Verify Inspect the SIP signaling and media routing: - Local branch user: `X-MS-UserLocation: internal` is present, `X-MS-MediaPath` lists only the downstream SBC, and media connects directly to the downstream SBC internal IP[^26][^17]. - External user: `X-MS-UserLocation: external` is present, `X-MS-MediaPath` lists the proxy SBC and then the downstream SBC, and media flows to the proxy SBC public IP[^26][^17]. - Inter-branch user: If the downstream SBC is in `Always` mode, media goes directly to its internal IP; if in `OnlyForLocalUsers` mode, media routes via the proxy SBC[^22][^23]. - Note that users may experience a few seconds of silence during initial call establishment due to architectural complexity[^30]. ### Rollback Suggested rollback: No configuration changes were made in this step. ## Step 12: Check the calls that are expected to leave the direct path **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Place calls that trigger non-bypass behavior: escalate a 1:1 call to a multiparty group call, place a call to a federated Teams user, transfer a call to a Skype for Business user, and route an incoming call through an Auto Attendant or Call Queue[^45][^46]. ### Verify Confirm that Microsoft Media Processors are inserted into the media path for these scenarios as expected by design, and confirm that two-way audio functions normally[^45][^46]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Place calls that trigger non-bypass behavior: escalate a 1:1 call to a multiparty group call, place a call to a federated Teams user, transfer a call to a Skype for Business user, and route an incoming call through an Auto Attendant or Call Queue[^45][^46]. ### Verify Confirm that Microsoft Media Processors are inserted into the media path for these scenarios as expected by design, and confirm that two-way audio functions normally[^45][^46]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Place test calls involving group escalations, federated users, and voice applications[^45][^46]. ### Verify Verify that Media Processors handle audio for voice apps and escalations[^46]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Place test calls involving group escalations, federated users, and voice applications[^45][^46]. ### Verify Verify that Media Processors handle audio for voice apps and escalations[^46]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Test voice application interactions, call hold and resume, and transfers: - Route calls through Auto Attendant and Call Queue services[^35]. - Place an active call on hold and resume it[^19]. - Transfer a call from an Auto Attendant to an LMO-enabled user[^35]. ### Verify Confirm expected media re-routing: - Voice application calls flow through the central/proxy SBC rather than following an optimized path, except when an Auto Attendant transfers directly to an LMO user, which follows the optimized path as a 1:1 call[^35]. - When a user puts a call on hold and resumes, the call continues via the central/proxy SBC rather than the optimized path, because hold escalates the call to multiparty and is never de-escalated[^19]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Test voice application interactions, call hold and resume, and transfers: - Route calls through Auto Attendant and Call Queue services[^35]. - Place an active call on hold and resume it[^19]. - Transfer a call from an Auto Attendant to an LMO-enabled user[^35]. ### Verify Confirm expected media re-routing: - Voice application calls flow through the central/proxy SBC rather than following an optimized path, except when an Auto Attendant transfers directly to an LMO user, which follows the optimized path as a 1:1 call[^35]. - When a user puts a call on hold and resumes, the call continues via the central/proxy SBC rather than the optimized path, because hold escalates the call to multiparty and is never de-escalated[^19]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Test calls involving Auto Attendant, Call Queue, and call hold and resume across proxy and downstream SBCs[^35][^19]. ### Verify Verify that voice app calls route through the proxy SBC, Auto Attendant transfers to LMO users optimize directly to the downstream SBC, and resuming held calls routes via the proxy SBC[^35][^19]. ### Rollback Suggested rollback: No configuration changes were made in this step. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Test calls involving Auto Attendant, Call Queue, and call hold and resume across proxy and downstream SBCs[^35][^19]. ### Verify Verify that voice app calls route through the proxy SBC, Auto Attendant transfers to LMO users optimize directly to the downstream SBC, and resuming held calls routes via the proxy SBC[^35][^19]. ### Rollback Suggested rollback: No configuration changes were made in this step. ## Step 13: Complete the rollout **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Once pilot users validate media path performance, update your production Online Voice Routing Policies to point remaining users to the bypass-enabled trunk[^2]. ### Verify Verify in Call Analytics and on the Direct Routing health dashboard that production call quality metrics and network effectiveness remain normal[^3][^54]. ### Rollback Revert the production Online Voice Routing Policies back to the original non-bypass trunk FQDN[^52]. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Monitor tenant call quality and SBC health in the Direct Routing health dashboard and Call Analytics following the cutover[^3][^54]. ### Verify Confirm that network effectiveness and average call duration metrics on the Direct Routing health dashboard remain steady[^3]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $false` to revert the trunk to non-bypass operation[^58]. **Media bypass only (clients reach the SBC's public IP) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Migrate remaining production users by updating their voice routing policy to use the bypass trunk[^2]. ### Verify Check Call Analytics and health dashboard metrics[^3]. ### Rollback Revert voice routing policies back to non-bypass trunks[^52]. **Media bypass only (clients reach the SBC's public IP) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Monitor Direct Routing dashboard metrics and SBC logs[^3][^54]. ### Verify Confirm trunk effectiveness remains stable[^3]. ### Rollback Set `Set-CsOnlinePSTNGateway -Identity -MediaBypass $false`[^58]. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + One central SBC with centralized trunks serving all sites** ### Do Point the remaining production users' Online Voice Routing Policies to the LMO-enabled trunk[^2]. ### Verify Verify call metrics across migrated sites on the Direct Routing health dashboard[^3]. ### Rollback Reassign voice routing policies to the non-bypass trunk[^52]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + One central SBC with centralized trunks serving all sites** ### Do Monitor the health dashboard and SBC logs for unexpected call drops or media path failures across all sites[^3][^54]. ### Verify Verify that network effectiveness ratings in the Direct Routing health dashboard remain uncompromised[^3]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $false -BypassMode None`[^58][^57]. **Local Media Optimization (internal and external SBC addresses, network sites) + Phased: Add a second bypass-enabled trunk FQDN and move pilot users by voice routing policy + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Update branch user Online Voice Routing Policies to target downstream and proxy SBC routes across the organization[^2][^28]. ### Verify Check that call volume establishes across downstream SBCs with stable network effectiveness on the Direct Routing dashboard[^3]. ### Rollback Revert user voice routing policies to routes pointing exclusively to non-bypass trunks[^52]. **Local Media Optimization (internal and external SBC addresses, network sites) + All at once: Turn on bypass on the existing trunk + A proxy SBC paired with Teams, plus downstream site SBCs that have no public IP** ### Do Monitor post-cutover performance across downstream and proxy SBCs using the Direct Routing health dashboard and Call Analytics[^3][^54]. ### Verify Confirm that call completion rates and health dashboard metrics remain stable[^3]. ### Rollback Run `Set-CsOnlinePSTNGateway -Identity -MediaBypass $false -BypassMode None` on proxy and downstream gateways[^58][^57]. ## Applicability Applies to: Microsoft Teams Phone Direct Routing, Microsoft Teams admin center, Microsoft Teams Phone, MicrosoftTeams PowerShell module, and IETF ICE. Deployments: on-premises, multi-tenant, dod, gcc, and gcc-high. Sources checked 2026-09-30. For government environments, Transport Relay ranges apply to GCC (`52.112.0.0/14`), GCC High (`52.127.88.0/21`), and DoD (`52.127.64.0/21`)[^50]. SIP signaling endpoints connect over port 5061 to `sip.pstnhub.microsoft.com` (commercial and GCC), `sip.pstnhub.gov.teams.microsoft.us` (GCC High), or `sip.pstnhub.dod.teams.microsoft.us` (DoD)[^73]. Direct Routing requires certified SBC firmware versions, such as Ribbon SBC Core 8.2 or higher, anynode 4.0.1+, or Avaya ASBCE 10.1.2 or higher for Local Media Optimization[^61]. ## What remains uncertain Whether Microsoft has officially retired the v4 Transport Relay port range (50000-59999) in favor of v6 ports (3478-3481) is not covered by the sources below. Whether Local Media Optimization is supported in GCC High and DoD sovereign clouds is not covered by the sources below. PowerShell cmdlets for deleting tenant network subnets, sites, and regions during rollback are not covered by the sources below. ## Sources [^1]: Microsoft lists three conditions to turn on media bypass: the SBC vendor supports it and documents SBC-side configuration, the trunk is switched with Set-CsOnlinePSTNGateway -Identity -MediaBypass $true, and the required ports are open. Source: [Configure media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-configure-media-bypass), Introductory numbered list (conditions 1-3). Checked 2026-09-30. [^2]: Microsoft recommends a phased migration to media bypass (new trunk for the same SBC on a different port, tested, then users' voice routing policy pointed to it) over switching all users at once, which exposes all production users to initial trunk and port issues. Source: [Configure media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-configure-media-bypass), Migrate from non-bypassed trunks to bypass-enabled trunks. Checked 2026-09-30. [^3]: The Direct Routing health dashboard, under Voice > Direct Routing in the Teams admin center, shows per-SBC TLS connectivity, SIP options status, network effectiveness and concurrent calls, and jitter, packet loss and latency measured from the Direct Routing interface to the SBC. Source: [Health dashboard for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-health-dashboard), View the health dashboard; The SBCs tab; Detailed information for each SBC. Checked 2026-09-30. [^4]: The SBC's ICE Lite implementation must respond to every connectivity check it receives and must not send connectivity check requests; Microsoft warns that sending them can surface unexpected peer-derived candidates and cause call failures. Source: [Direct Routing support for media bypass - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-media), ICE Lite requirements > Connectivity checks. Checked 2026-09-30. [^5]: Because an inbound call can fork to several Teams endpoints of one user, the SBC must answer connectivity checks and accept nominations from multiple endpoints, before or after the 200 OK, and must not change ICE candidates, password or ufrag between a 183 and the 200 OK. Source: [Direct Routing support for media bypass - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-media), ICE Lite requirements > Nominations and Converging for forking; Scenarios > Outbound call to SBC, Note. Checked 2026-09-30. [^6]: In media bypass the SBC must offer only one ICE candidate, and only IPv4 candidates are currently supported. Source: [Direct Routing support for media bypass - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-media), ICE Lite requirements > Candidate gathering. Checked 2026-09-30. [^7]: Plain media bypass cannot serve branch SBCs that lack public IPs, because bypass requires the client to reach the SBC's public IP while downstream SBCs are reachable by Teams only through a proxy SBC defined in the LMO virtual topology; a proxy/downstream design therefore implies Local Media Optimization (inferred). Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Proxy SBC with connected downstream SBCs; combined with ms-learn-dr-media-bypass 'Call flow if the user has direct access to the public IP address of the SBC' and ms-learn-set-csonlinepstngateway -ProxySbc ('Used in Local Media Optimization configurations'). Checked 2026-09-30. [^8]: In a proxy/downstream LMO design the proxy SBC must have IP reachability to each downstream SBC's internal address, since external users' media and Only-for-local-users cross-site media are relayed by the proxy to the downstream SBC (inferred). Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Proxy SBC with connected downstream SBCs, External user; Mode 2 Scenario 2 (proxy redirects to internal IP of downstream SBC). Checked 2026-09-30. [^9]: Microsoft's monitoring pages describe no dedicated indicator of whether a given call was bypassed, so the practical evidence of the media path is on the SBC: the negotiated remote media address (client, Transport Relay or Media Processor range) and, with LMO, the X-MS headers received (inferred). Source: [Monitor Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-monitor-and-troubleshoot), Whole page (no media-bypass indicator described); combined with ms-learn-dr-health-dashboard and ms-learn-dr-media-bypass port/range tables. Checked 2026-09-30. [^10]: IPv6 on Direct Routing is supported only for non-media-bypass scenarios: media bypass is not supported with IPv6 SIP or media or with the IPv6 Teams client. Source: [Connect your Session Border Controller (SBC) to Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-connect-the-sbc), Use PowerShell > Connect the SBC to the tenant > Considerations, IPAddressVersion bullet. Checked 2026-09-30. [^11]: Always Bypass is the simplest LMO mode to configure, and the tenant administrator can configure a single site for all users and SBCs if all SBCs are reachable from any site. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Call flows > Always Bypass mode, paragraph 1. Checked 2026-09-30. [^12]: Microsoft recommends Local Media Optimization for keeping media inside the intranet, but says a tenant that already uses media bypass with only the public IPs of its SBCs does not need to move to Local Media Optimization. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Introduction, Note. Checked 2026-09-30. [^13]: If an SBC does not have -BypassMode set, Direct Routing does not send the X-MS headers that Local Media Optimization relies on. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Define the virtual network topology, notes bullet 3. Checked 2026-09-30. [^14]: LMO configuration parameters are case sensitive, so GatewaySiteID values such as "Vietnam" and "vietnam" are treated as different sites. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Define the network topology, paragraph 2; Define the virtual network topology, notes bullet 4. Checked 2026-09-30. [^15]: In the central-SBC scenario the SBC offers its internal IP for media when the user is on the corporate network and its external (public) IP when the user is outside it, while being visible to Teams Phone through its external IP only. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Central SBC with centralized trunks; Internal user and External user subsections. Checked 2026-09-30. [^16]: Configuring Local Media Optimization requires configuring the user and SBC sites (external trusted IPs, network regions, sites and subnets, then assigning SBCs to sites with modes and proxy values) and configuring the SBCs per the SBC vendor's specification; the network part can be done in the Teams admin center or PowerShell. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Introduction numbered list; Configure the user and the SBC sites, numbered list. Checked 2026-09-30. [^17]: Downstream SBCs have no public IPs but can be assigned to voice routes; users in the downstream SBC's branch send media to it directly, while external users send media to the proxy SBC's public IP, which proxies it to the downstream SBC. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Proxy SBC with connected downstream SBCs, paragraphs 2-3. Checked 2026-09-30. [^18]: The LMO virtual network topology is defined by creating each SBC with New-CsOnlinePSTNGateway and then setting -GatewaySiteID, -MediaBypass, -BypassMode (Always or OnlyForLocalUsers) and -ProxySBC with Set-CsOnlinePSTNGateway. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Define the virtual network topology, paragraph 1 and syntax block. Checked 2026-09-30. [^19]: After a Teams user puts an LMO call on hold and resumes it, the call continues via the central (proxy) SBC rather than the optimized path, because hold escalates the call to multiparty and it is by design never de-escalated. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Known behaviors table, row 2. Checked 2026-09-30. [^20]: On an inbound LMO call the user's location is unknown to the SBC, which offers local media candidates by default and must send a re-INVITE if the user turns out to be external; Direct Routing calculates the media path from the Record-Route and Contact fields the SBC supplies. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Call flows > Always Bypass mode > Inbound calls and the user is in the same location as the SBC; Inbound calls and the user is external. Checked 2026-09-30. [^21]: When Local Media Optimization and Location-Based Routing are configured together, each downstream SBC must have GatewaySiteLbrEnabled set to $true; this is not mandatory for the proxy SBC. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Define the virtual network topology, Note after example commands. Checked 2026-09-30. [^22]: In Always bypass mode an internal user's media goes to the downstream SBC's internal IP wherever in the corporate network the user is, and Microsoft recommends this mode when connectivity between branch offices is good. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Local Media Optimization modes, Mode 1; Mode 1: Always bypass, paragraph 1. Checked 2026-09-30. [^23]: In Only for local users mode media goes directly to the downstream SBC's internal IP only for internal users in the same branch; Microsoft recommends it when links between branches are poor but each branch links well to a regional office, with the regional proxy SBC set to Always and downstream SBCs set to OnlyForLocalUsers. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Local Media Optimization modes, Mode 2; Mode 2: Only for local users, paragraphs 1-3. Checked 2026-09-30. [^24]: The -MediaBypass parameter must be set to $true for an SBC to support Local Media Optimization. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Define the virtual network topology, notes bullet 2. Checked 2026-09-30. [^25]: With Local Media Optimization, internal users must have media connectivity to the SBC's internal IP; there is no fallback to public Transport Relays because the SBC offers an internal IP. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Local Media Optimization modes, Note. Checked 2026-09-30. [^26]: In Microsoft's Always-bypass examples, an outbound call from an internal user at the downstream site carries X-MS-UserLocation: internal and X-MS-MediaPath naming only the downstream SBC, while an external user's call carries X-MS-UserLocation: external and X-MS-MediaPath listing the proxy SBC then the downstream SBC. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Call flows > Always Bypass mode > Outbound calls and the user is in the same location as the SBC / Outbound calls and the user is external, header tables. Checked 2026-09-30. [^27]: Local Media Optimization lets administrators keep media local within corporate network subnets and allows media between Teams clients and SBCs even when the SBCs sit behind corporate firewalls with private IPs not directly visible to Microsoft. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Introduction, bulleted list. Checked 2026-09-30. [^28]: Microsoft's LMO examples use an Online Voice Routing Policy whose priority-1 route sends local numbers (for example ^+84(\d{9})$) to the downstream SBC and whose priority-2 route .* sends all other calls, and local calls if the downstream SBC fails, to the proxy SBC. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Mode 2: Only for local users > Scenario 1, paragraph and Table 5. Checked 2026-09-30. [^29]: Local Media Optimization supports two scenarios: a central SBC with centralized trunks serving all branches, and a proxy SBC paired with Teams through its external IP with downstream branch SBCs that communicate over internal IPs and are not directly visible to Teams Phone. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Introduction, 'Local Media Optimization supports two scenarios'. Checked 2026-09-30. [^30]: With Local Media Optimization a user might hear a few seconds of silence while a call is being established, which Microsoft attributes to the complexity of the architecture. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Known behaviors table, row 3. Checked 2026-09-30. [^31]: For a single SBC (the central SBC with centralized trunks scenario), -ProxySBC must be set either to $null or to that SBC's own FQDN; Microsoft's example sets the proxy SBC itself with -ProxySBC $null and each downstream SBC with -ProxySBC set to the proxy's FQDN. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Define the virtual network topology, notes bullet 1 and example commands. Checked 2026-09-30. [^32]: A Teams client is not identified as internal when its public IP matches the trusted IP list but its subnet matches no network site; Local Media Optimization requires a matching network site for every connection from a listed trusted IP. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Known behaviors table, row 1. Checked 2026-09-30. [^33]: The LMO network topology is defined with New-CsTenantNetworkRegion, New-CsTenantNetworkSite (each site tied to a region) and New-CsTenantNetworkSubnet (each subnet tied to exactly one site). Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Define the network topology > Define network regions / sites / subnets. Checked 2026-09-30. [^34]: For Local Media Optimization, the external internet IPs that Teams clients use to reach Microsoft 365 must be added for every site with LMO users using New-CsTenantTrustedIPAddress, with mask 32 for single IPv4 addresses, 128 for IPv6, and both families added if Microsoft 365 sees both. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Manage external trusted IP addresses. Checked 2026-09-30. [^35]: Calls involving voice apps such as Auto Attendant and Call Queue are not optimized by Local Media Optimization and flow through the proxy SBC, except transfers from an Auto Attendant to an LMO user, which follow the optimized path as a direct 1:1 call. Source: [Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization), Known behaviors table, row 4 (Voice apps). Checked 2026-09-30. [^36]: With split-tunnel VPN, a client detected as external is signalled to the SBC as external even if it can reach the SBC's internal interface, which can cause prolonged call setup or no audio on PSTN calls; Microsoft says VPN administrators must block access between remote VPN users and the SBC internal interface. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Configure the user and the SBC sites, Note. Checked 2026-09-30. [^37]: When BypassMode is defined, Direct Routing adds X-MS-UserLocation (internal or external), X-MS-MediaPath (the ordered SBCs for the media path, target SBC last) and X-MS-UserSite (the administrator-defined site) to INVITEs and re-INVITEs, and puts the target SBC FQDN in the Request-URI even when that SBC is not directly connected. Source: [Configure Local Media Optimization for Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-media-optimization-configure), Define the virtual network topology, X-MS Headers table. Checked 2026-09-30. [^38]: When two trunks share one SBC, the SBC certificate must cover both FQDNs, either as two SAN names or with a wildcard certificate. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Configure separate trunks for media bypass and non-media bypass, paragraph after the example table. Checked 2026-09-30. [^39]: Direct media between client and SBC is UDP/SRTP with client ports 50000-50019 and SBC ports defined on the SBC, in both directions; if a network device translates client source ports, the translated ports must be opened towards the SBC. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Media traffic: IP and Port ranges > Requirements for direct media traffic, table and Note. Checked 2026-09-30. [^40]: For media bypass the Teams client must be able to reach the SBC's public IP address even from the internal network; Microsoft notes hairpinning can be configured on the NAT device so that traffic never leaves enterprise network equipment. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Call flow if the user has direct access to the public IP address of the SBC, bullet 1; Requirements for direct media traffic, Note. Checked 2026-09-30. [^41]: Media bypass is supported on standalone Teams desktop clients, Android and iOS clients and Teams Phone devices; calls on other endpoints, including Teams web clients and Skype for Business 3PIP phones, are automatically converted to non-bypass. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Client endpoints supported with media bypass. Checked 2026-09-30. [^42]: With media bypass, Direct Routing media is kept between the SBC and the Teams client instead of passing through Microsoft Teams Phone, and Microsoft states the SBC and client must be in the same location or network for it to apply. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), About media bypass with Direct Routing, paragraph 1. Checked 2026-09-30. [^43]: Microsoft recommends not exposing the SBC public IP to external clients and instead opening it only to the Microsoft cloud so external users' bypassed media is relayed by Teams Transport Relays; letting external clients reach the SBC public IP directly is listed as not recommended. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Call flow if the user doesn't have access to the public IP address of the SBC; Call flow if a user is outside the network and has access to the public IP of the SBC, Note. Checked 2026-09-30. [^44]: Media bypass uses ICE on the Teams client and ICE Lite on the SBC to find the most direct media path. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), About media bypass with Direct Routing, paragraph after the Frankfurt example. Checked 2026-09-30. [^45]: Even on a bypass trunk, Media Processors are always inserted when a call escalates from 1:1 to a group call, goes to a federated Teams user, or is forwarded or transferred to a Skype for Business user. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Use of Teams Media Processors if trunk is configured for media bypass. Checked 2026-09-30. [^46]: Media Processors are never in the media path for bypassed end-user calls but are always in the path for voice applications such as Call Park, Auto Attendant and Call Queues, and for Teams web clients. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Use of Media Processors and Transport Relays, bullets and summary table; Requirements for using media processors. Checked 2026-09-30. [^47]: Media bypass is controlled per SBC with Set-CsOnlinePSTNGateway and the -MediaBypass parameter set to true or false; enabling it does not mean all media stays inside the corporate network. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), About media bypass with Direct Routing, paragraph 2. Checked 2026-09-30. [^48]: Microsoft's media bypass planning page lists both 52.112.0.0/14 and 52.120.0.0/14 in its Media Processor and Transport Relay summary and as the subnets the pstnhub signaling FQDNs resolve to, but its Transport Relay and Media Processor port-requirement sections for Microsoft 365, Office 365 and GCC list 52.112.0.0/14 only. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Use of Media Processors and Transport Relays, 'The IP ranges are'; SIP Signaling: FQDNs; Requirements for using Transport Relays; Requirements for using media processors. Checked 2026-09-30. [^49]: For bypassed calls relayed by Teams Transport Relays, the SBC must allow UDP/SRTP from relays on source ports 50000-59999 and send to relays on 50000-59999 and 3478-3481, because relay version v4 uses only 50000-59999 and v6 uses 3478-3481. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Requirements for using Transport Relays, port table and Note. Checked 2026-09-30. [^50]: Transport Relays for bypassed calls use the same ranges as Media Processors: 52.112.0.0/14 for Microsoft 365, Office 365 and GCC, 52.127.88.0/21 for GCC High and 52.127.64.0/21 for DoD. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Requirements for using Transport Relays, per-environment subsections. Checked 2026-09-30. [^51]: Transport Relays are in the path of a bypassed end-user call only when the client cannot reach the SBC on its public IP address, and because relays are not B2BUAs the codec is never changed between client and SBC. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Use of Media Processors and Transport Relays, summary table and transcoding explanation. Checked 2026-09-30. [^52]: To trial media bypass, Microsoft describes creating a second trunk with a different FQDN on the same SBC with media bypass enabled, using a different TLS signaling port but the same media ports, then a new Online Voice Routing Policy routing to that trunk assigned to the test users. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Configure separate trunks for media bypass and non-media bypass, high-level steps. Checked 2026-09-30. [^53]: With media bypass, SIP signaling always flows via the Microsoft cloud; only media takes the direct path. Source: [Plan for media bypass with Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan-media-bypass), Call flow and firewall planning > Call flow if the user has direct access to the public IP address of the SBC, bullet 3. Checked 2026-09-30. [^54]: Call Analytics shows SIP codes only for calls that reach Direct Routing's internal components; for pairing problems or rejected INVITEs Microsoft directs administrators to the SBC logs, where Direct Routing's detailed error descriptions appear. Source: [Monitor Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-monitor-and-troubleshoot), Monitor Call Quality Analytics dashboard and SBC logs, final paragraph. Checked 2026-09-30. [^55]: A client whose external IP matches no trusted IP is classified as being at an unknown location, and network configuration lookups are not supported with cloud proxy services that modify Teams clients' source IP addresses. Source: [Network settings for cloud voice features](https://learn.microsoft.com/en-us/microsoftteams/cloud-voice-network-settings), Trusted IP address section, final paragraph and Important note. Checked 2026-09-30. [^56]: Changes to Teams network settings can take up to four hours to propagate to Teams clients. Source: [Network settings for cloud voice features](https://learn.microsoft.com/en-us/microsoftteams/cloud-voice-network-settings), Introduction, paragraph 4. Checked 2026-09-30. [^57]: Set-CsOnlinePSTNGateway -BypassMode accepts None, Always and OnlyForLocalUsers with a default of None; Always indicates a fully routable network between sites, OnlyForLocalUsers indicates no direct connection between sites. Source: [Set-CsOnlinePSTNGateway (MicrosoftTeams)](https://learn.microsoft.com/en-us/powershell/module/microsoftteams/set-csonlinepstngateway), Parameters > -BypassMode. Checked 2026-09-30. [^58]: The -MediaBypass parameter of Set-CsOnlinePSTNGateway indicates that the SBC supports media bypass and the administrator wants to use it, and its default value is $false. Source: [Set-CsOnlinePSTNGateway (MicrosoftTeams)](https://learn.microsoft.com/en-us/powershell/module/microsoftteams/set-csonlinepstngateway), Parameters > -MediaBypass. Checked 2026-09-30. [^59]: RFC 8445 defines lite ICE agents as using only host candidates and not generating connectivity checks or running state machines, while still responding to connectivity checks; RFC 8445 obsoletes RFC 5245, which Microsoft's pages still cite. Source: [RFC 8445: Interactive Connectivity Establishment (ICE): A Protocol for Network Address Translator (NAT) Traversal](https://www.rfc-editor.org/rfc/rfc8445), Section 2.5 (Lite implementations); Section 4 (Terminology); document header. Checked 2026-09-30. [^60]: Microsoft's certified SBC list marks non-media-bypass and media-bypass certification separately, and some certified products (for example Thinktel Think 365 SBC, Patton SmartNode eSBC and Frafos ABC SBC) are certified for non-media bypass only. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Certified SBC vendors table, Media bypass column. Checked 2026-09-30. [^61]: Local Media Optimization support is listed in a separate table with its own minimum software versions (for example Ribbon SBC Core 8.2 or higher, anynode 4.0.1+, Avaya ASBCE 10.1.2 or higher), distinct from the media bypass certification versions. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Support for Local Media Optimization table. Checked 2026-09-30. [^62]: Media re-targeting is not supported: if the SBC signals a new media IP during a Direct Routing call, Teams Direct Routing never sends media to the new address even though it was negotiated in SIP. Source: [Session Border Controllers certified for Direct Routing - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-border-controllers), Final Note on the page. Checked 2026-09-30. [^63]: With media bypass, Direct Routing does not strip non-audio m-lines (for example m=video on a forwarded video call), so the SBC must answer each non-audio m-line with port zero per RFC 3264 to reject it. Source: [Direct Routing support for media bypass - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-media), Scenarios > Handling M lines in SDP. Checked 2026-09-30. [^64]: In bypass mode the SBC must support SRTP cipher AES_CM_128_HMAC_SHA1_80, and its SDP offer must contain SDES (DTLS optional); if a client is DTLS-only, Direct Routing inserts a Media Processor and converts the call to non-bypass. Source: [Direct Routing support for media bypass - Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-protocols-media), SRTP support requirements; SDES support requirements; Format for offer from SBC in bypass mode. Checked 2026-09-30. [^65]: In the Teams admin center, network sites (with region and subnets) are configured under Locations > Network topology > Network sites, and external trusted IPs under Locations > Network topology > Trusted IPs. Source: [Manage your network topology for cloud voice features in Microsoft Teams](https://learn.microsoft.com/en-us/microsoftteams/manage-your-network-topology), Configure network settings in the Microsoft Teams admin center; Manage external trusted IP addresses. Checked 2026-09-30. [^66]: The SBC settings table in Microsoft's connect-the-SBC article lists no media bypass, bypass mode, gateway site or proxy SBC field for the Teams admin center, so PowerShell (Set-CsOnlinePSTNGateway) is the documented way to apply them; GCC High and DoD must use PowerShell to connect SBCs in any case (inferred). Source: [Connect your Session Border Controller (SBC) to Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-connect-the-sbc), SBC settings table; opening Note on GCC High and DoD. Checked 2026-09-30. [^67]: Microsoft's documented pairing check is Get-CsOnlinePSTNGateway -Identity showing the SBC with Enabled True, plus confirming in the SBC management interface that OPTIONS in both directions are answered with 200 OK. Source: [Connect your Session Border Controller (SBC) to Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-connect-the-sbc), Verify the SBC connection. Checked 2026-09-30. [^68]: Direct Routing requires a Microsoft-certified SBC, PSTN trunks to it, users homed online, a public IP, an SBC FQDN in a verified tenant domain (not *.onmicrosoft.com) with public DNS, and a publicly trusted TLS certificate. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Plan Direct Routing, section 'Infrastructure requirements' table and section 'SBC domain names'. Checked 2026-09-24. [^69]: Direct Routing requires users to be homed online in Microsoft 365. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Infrastructure requirements table, User registrar row. Checked 2026-09-25. [^70]: Microsoft supports Teams Phone with Direct Routing only when certified SBCs are used, expects the SBC vendor to investigate first and escalate, and may decline support requests involving non-certified SBCs. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Plan Direct Routing, sections 'Supported Session Border Controllers (SBCs)' and 'Support boundaries'. Checked 2026-09-24. [^71]: Direct Routing supports SILK, G.711, G.722, G.729 and AMR-WB between Teams and the SBC, with AMR-WB supported only without media bypass. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Plan Direct Routing, section 'Supported codecs'. Checked 2026-09-24. [^72]: Direct Routing media between Microsoft media processors and the SBC uses UDP/SRTP ports 3478-3481 and 49152-53247 in both directions, and Microsoft recommends at least two media ports per concurrent call on the SBC. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Plan Direct Routing, section 'Media ports' table and Tip. Checked 2026-09-24. [^73]: For Microsoft 365, Office 365 and GCC, the SBC connects to sip.pstnhub.microsoft.com, sip2.pstnhub.microsoft.com and sip3.pstnhub.microsoft.com in priority order over SIP/TLS to port 5061; GCC High uses sip.pstnhub.gov.teams.microsoft.us and DoD uses sip.pstnhub.dod.teams.microsoft.us. Source: [Plan Direct Routing](https://learn.microsoft.com/en-us/microsoftteams/direct-routing-plan), Plan Direct Routing, sections 'SIP signaling: FQDNs', 'SIP signaling: GCC High', 'SIP signaling: DoD', 'SIP signaling ports'. Checked 2026-09-24.